Every field has a source. Every source has a legal basis.
This page is the policy itself, not a marketing summary. It maps every data category Kestrel ingests to a source, a legal basis under India's DPDP Act, 2023, and a refresh cadence. Last lawyer review: 2026-05-15.
The legal frame.
India's Digital Personal Data Protection Act, 2023, came into force on 13 May 2027. Rules were notified on 13 November 2025.
Section 3(c)(ii) of the Act explicitly carves out from its scope personal data that is:
- Made publicly available by the data principal (the individual it belongs to), or
- Made publicly available by any other person under any law (statutory mandates, e.g., MCA filings).
Phase 1 of Kestrel ingests only data falling under one of those two carve-outs. Where a field is non-personal company data, it is outside the Act entirely.
Source-by-source map.
MCA21 (Ministry of Corporate Affairs)
https://www.mca.gov.in
Company master data, directors, charges, filings. Public under the Companies Act, 2013.
data.gov.in (MCA Company Master Data catalog)
https://data.gov.in
Bulk dumps of MCA company master data, used for backfill and reconciliation.
GST Network (public taxpayer search)
https://services.gst.gov.in
GSTIN lookup, taxpayer status, principal place of business. Public via GST Act.
Udyam Registration Portal
https://udyamregistration.gov.in
MSME registration data, turnover band, employee band, NIC code.
DGFT (Directorate General of Foreign Trade)
https://dgft.gov.in
IEC holders, export-import statistics, EPCG and advance authorization data.
ICEGATE / Indian Customs
https://icegate.gov.in
Shipping bills, bill of entry, HS-code-wise trade data. Aggregated public statistics.
Company websites (own domain, self-published)
per-company
Public firmographics, contact, products from the company's own website. Respects robots.txt.
LinkedIn public company pages
https://linkedin.com
Public company-page firmographics (industry, headcount band, HQ). Person-level data excluded.
IndiaMART public seller listings
https://indiamart.com
Public seller-published firmographics, products. Self-disclosed turnover and employee bands.
TradeIndia public seller listings
https://tradeindia.com
Public seller-published firmographics. Self-disclosed export markets.
What is explicitly out of scope.
- Personal mobile numbers not self-published by the individual on a public registry.
- Personal emails not self-published by the individual.
- Inbox-harvesting browser extensions, of any kind.
- Any data ingested via a contributory mechanic that captures customers' contacts.
- Any source that blocks Kestrel in robots.txt.
- Any source where the terms of service prohibit data collection by us.
- Any data derived from a breach, leak, or dark-web source.
Your rights, plumbed in.
- Right to access: see what we store about you, free, within 30 days.
- Right to correction: ask us to correct any inaccurate field, within 30 days.
- Right to erasure: we redact or remove the regulated fields, within 30 days.
- Right to grievance: a named grievance officer responds within 7 days.
- Right to consent withdrawal: applies when Phase 2 person tier launches.
Policy version 0.4. Last reviewed by counsel on 2026-05-15. Reviewed every quarter or on any new source addition, whichever is sooner. Material changes are published with a dated changelog at the foot of this page. Questions: dpo@kestrel.in.